Tony Papagiannopoulos has always been careful with money.
It was drummed into him after moving to Australia from Greece with his mother and little more than a suitcase when he was just 15.
Mr Papagiannopoulos, now 52, spoke no English when he arrived. He studied hard, eventually mastering his second language and working his way through an IT degree.
He saved scrupulously through his 25-year career in the private and public sectors, self-managing most of the money for retirement.
In March this year, he started looking to move $200,000 – a large chunk of his retirement savings – from an investment that wasn’t doing very well.
“I spoke to a couple of accountants, a couple of different people,” he said.
“They said, ‘You’re going to have to either go to shares if you want to take a bigger risk or you have to go to bonds, which is somewhere in the middle.’
“I thought, ‘OK, I’ll have a look at bonds, see what they do and how they work.'”
So he turned to the first place most other Australians would: Google.
Mr Papagiannopoulos searched for “Australian bonds investment” comparison sites and clicked on the first few that came up.
“They looked secure – the website came up professionally,” he said.
The sites he visited offered information in writing and an option to get a call from someone to talk about the investment.
Mr Papagiannopoulos put in his name and number.
“I was learning [and] wanted to talk to some advisers to tell me exactly what are the pros and cons with this,” he said.
According to the experts, this style of scam is becoming more common.
“You think you’re doing the work,” Richard Buckland, a cybersecurity expert of more than 20 years, told the ABC.
“It’s not someone contacting you out of the blue [like a text or email], you’re contacting someone.”
The day after he put in his contact details, Mr Papagiannopoulos got a call from a woman.
She said she was Jane Weaver from JP Morgan. She put him through to a man claiming to be her senior colleague, Andrew Duncan.
Mr Duncan told Mr Papagiannopoulos he was a financial adviser.
Mr Papagiannopoulos said Mr Duncan came off as relaxed and professional in his emails and during their conversations, and he believed he was calling from JP Morgan’s head office.
“[He was] very well spoken, he certainly knew his stuff,” Mr Papagiannopoulos said.
“Me being a little bit further behind on the knowledge, I was learning a lot more as I was trying to understand exactly what he meant.
“I asked him to provide me with details of his proposal in writing, which he did very quickly on the same day.”
He received a prospectus via email from info@jpmorganbonds.com.
The email, which had a JP Morgan email signature, included the estimated fixed rate of return.
Mr Papagiannopoulos said Mr Duncan, who spoke with a slight British accent, didn’t pressure him at all.
“Look,” Mr Duncan told Mr Papagiannopoulos.
“These particular bonds are running up by the end of the month.
“You just have to make up your mind and see which way you want to go and find out how much money you want to spend.”
Mr Papagiannopoulos spent a few days mulling over the offer.
The due diligence
The prospectus included a phone number for Mr Duncan.
But Mr Papagiannopoulos decided to look up JP Morgan’s phone number online to make sure the firm really did have a retail investment division.
First, he called one of the company’s realhead offices in London. He was told to call the Australian office.
He then called the Melbourne office, which he said directed him to the Australian headquarters in Sydney.
But he said when he tried to call the Sydney office in March, there was a message saying the line had been disconnected.
In a statement to the ABC, JP Morgan said it was “not aware of any service outages” with its phones at that time.
But Mr Papagiannopoulos said he was having trouble getting through, so he called the number from the prospectus he’d been sent.
It went straight to a voice message Mr Papagiannopoulos said sounded “exactly” like the one when he called the England office.
“Thank you for calling JP Morgan Australia,” it said, but in an Australian accent.
“All calls are recorded for training and monitoring purposes. We are fully authorised and regulated by the Australian Prudential Regulation Authority.
“Unfortunately all our representatives are busy with other clients. Please leave your name and number and we will call you as soon as we become available. Thank you.”
He eventually got through to Mr Duncan.
“I said, ‘Is this your new number?’
“He said, ‘Yes, that’s our new connection. And that’s what we’re going to be using now.'”
Mr Papagiannopoulos said the more he spoke to Mr Duncan – always getting through to him through a professional sounding switchboard – the more he trusted him.
“The way that he’s presented himself, his documentations, [I] couldn’t fault him,” he said.
He decided to invest.
“I was very sure I was speaking to JP Morgan at the time, simple. Otherwise I wouldn’t have gone any further,” he said.
Mr Papagiannopoulos was asked via email to provide the usual ID you’d need to set up a bank account.
Once he was “approved” they told him where to send the money.
“He sent me a proper form with all the details,” he said. “It was a Westpac account that I had to transfer the money to. I knew Westpac very well because I’d been a customer for 20 years.”
On March 25, a week after receiving the prospectus, he transferred the first instalment of $100,000.
Five days later, he sent through another $100,000.
Hours later, the whole thing came undone.
The phone call
When Mr Papagiannopoulos’s wife’s phone rang, a warning flashed up saying the incoming call might be a scam.
Usually she’d ignore such calls, but on this day she answered it.
The person on the other end of the line introduced herself as “Jane Weaver from JP Morgan”.
It was the same number Mr Papagiannopoulos had been using for his calls with Ms Weaver and Mr Duncan.
Mr Papagiannopoulos had given the scammers his wife’s number as a secondary contact and in case she wanted to make an investment at some point too.
He googled the number, and on the third page of results he saw complaints stemming back to 2016 identifying the number as one used by scammers.
“It made me feel sick,” he said.
In a statement, JP Morgan said Mr Papagiannopoulos had been targeted by a “sophisticated scam” and encouraged investors to remain vigilant, conduct due diligence and to seek independent financial advice before investing.
It said it became aware that scammers were posing as JP Morgan in April and notified the financial markets regulator, ASIC, as well as publishing an alert on its website.
Meanwhile, Mr Papagiannopoulos had immediately set about getting his money back.
He started with Citi, the bank he sent the money from, calling it to stop both transactions immediately.
He then contacted and visited his local Westpac branch.
He said Westpac confirmed the account did not actually belong to JP Morgan, and he asked them to put a freeze on it.
Citi said it also contacted Westpac and asked the bank to stop the transfers.
By the day’s end, Ms Weaver sent an email saying there’d been a problem with the second $100,000 deposit.
As he frantically tried to work out what was happening with his money, Mr Papagiannopoulos said he felt helpless.
He said his first meaningful communication with Citi didn’t come until weeks after the scam.
“I was hammering them daily, [I] made multiple complaints, emails and phone calls.”
But Citi told the ABC it acted swiftly.
“Citi is committed to responding urgently when advised of a scam and [it] acted immediately in this instance, leading to the recovery of almost all of the funds,” Richard Wilde, head of retail banking at Citi Australia, said.
In April, the bank managed to recover $114,000 of the $200,000, and returned it to Mr Papagiannopoulos two weeks after the scam. The bank apologised for the “distressing situation”.
“Citi’s local head of fraud remained in touch with the customer directly to keep him informed as we tracked down his money,” Mr Wilde said.
Mr Papagiannopoulos reported the incident to the police as soon as he realised the scam. He said he went to three different police stations before anyone would take a statement.
A senior sergeant was eventually assigned to investigate his case, he said. A spokeswoman for Victoria Police said normal procedures had been followed and the investigation remained ongoing.
Mr Papagiannopoulos also tried to get hold of Mr Duncan but the once-helpful “senior accounts manager” was nowhere to be found, with all his calls going straight to an answering machine.
“I should have known better,” Mr Papagiannopoulos said.
“I let my family down.
“That’s where I’m punishing myself daily.”
Westpac told the ABC that due to confidentiality obligations, it was unable to comment on individual customer matters.
It said it had a specialist team of staff trained to assist customers impacted by scams, but “in general” there had been a rise in reported scam activity.
But there would be more twists to the tale in Mr Papagiannopoulos’s bid to recoup his money.
The solution?
Mr Papagiannopoulos still feels bitter about the difficulty in trying to get someone to give him information about the fate of his money.
But more than that, he believes there needs to be regulation to force all banks to change their systems to match the BSB, account number and account name of every transaction – and many regulators agree.
Australian banks are required to provide a warning that the name given by the customer transferring money will not be checked against the BSB and account number.
Citi’s electronic transfer system includes this warning.
So when Mr Papagiannopoulos entered the name of the account as “JP Morgan Pty Ltd”, he had no way of knowing that did not match the account’s registered name
Last year the UK introduced the kind of regime that Mr Papagiannopoulos wants to see adopted here.
As of July 2020, six major UK banks were required to check that the name entered by the person making the transfer matched the name of the account holder.
The UK’s Payment Systems Regulator (PSR) told the ABC anecdotal evidence indicated a “positive impact”.
Do you know more about this story? Email Specialist.Team@abc.net.au.
Locally, the Australian Competition and Consumer Commission has been calling on the Australian banks to follow the UK “for years”.
Andy White from the Australian Payments Network, which oversees payments in the banking system, said banks were now using the Pay ID service, which provided an extra level of verification through a phone number or email.
Mr White said about a third of all transactions were made through Pay ID and it “wasn’t practical” to retrofit the existing bank deposit system to match names.
Austrac, which is charged with preventing, detecting and responding to criminal abuse of the financial system, said banks were obligated to verify a customer before an account was set up to prevent the creation of fraudulent bank accounts.
Westpac said when transferring money, customers should check the account numbers and name of the account with the intended recipient, before making the payment.
But the bank did not address the ABC’s specific questions on how the scammers had managed to set up an account with the bank.
The other victim
As Mr Papagiannopoulos pored over his documents one evening, wondering how he fell for the scam, he noticed something curious.
There was a private email address he didn’t recognise copied in at the bottom of one of Mr Duncan’s emails.
Mr Papagiannopoulos wondered if it was someone else who’d been sucked in by the scam, so he sent an email to the address.
The recipient, a retiree in regional New South Wales, initially thought Mr Papagiannopoulos’s email itself was a scam.
The woman, who only wants to be known as Jill, said she immediately phoned her JP Morgan contact: Jane Weaver.
“I said to her: ‘I’ve just received an email from Tony Papas (Papagiannopoulos).
“He says he’s received an email from you about his investment with you but it has our details on the bottom of it.
“And it’s looking very much like a scam.”
“Absolutely not,” Ms Weaver told Jill.
“This is not a scam, this is a genuine investment, I have never heard of Tony Papas’.”
Ms Weaver told Jill she’d get JP Morgan’s security people to call her straight back to discuss the email.
“I’ve never heard a word since,” Jill said.
Jill and her husband, both self-funded retirees, had transferred a total of $75,000 to a Westpac bank account from two separate accounts on March 25 and again on March 26 – the same time as Mr Papagiannopoulos’s first deposit.
Two days later, they received a bond certificate, which they understood meant they’d be paid a quarterly dividend from their investment.
The bond certificate even carries the name and signature of JP Morgan’s real chief executive, Paul Uren.
“We would not have known anything if it hadn’t been for an email we received from Tony,” Jill said.
“[The scammers] obviously opened accounts in each state. Tony’s was Victoria. Ours was at Fairfield in NSW.”
The couple has been told the money was quickly transferred overseas and there’s little hope they’ll see it again. Their case is now in the hands of New South Wales Police.
“Apart from how distressing and gut-wrenching [this is], I feel embarrassed,” Jill said.
She said she felt sure others would have been scammed.
“I’m afraid of how many people they’ve got in this one, and how much money is involved.”
The scam trade
Professor Buckland said the chance of the criminals being caught was low – even finding out which country they were from was difficult.
“This whole thing, it’s the gig economy to the extreme,” he said.
“All the hosting services are not in Australia, the weapons are out of the country, the VoIP service [to use the phone number].
“I would assume people running this would be running it at scale.
“They might have a different phone number for every person or every company they’re pretending to be … but they’re probably running multiple ones in multiple countries at the same time.”
And it’s cheap.
All up, Professor Buckland estimates the fake websites cost the scammers about $20 for each.
“These ones were all set up around about the same time,” he said. “One of them [this year], just a day or two before Tony got caught, actually.”
Scammers stole $851 million from Australian victims in 2020. Of that, $328 million was through fake investment opportunities – the most of any type of scam.
ACCC deputy chair Delia Rickard said investment scams were continuing to increase in scale and sophistication.
“One of the trends we’ve seen in 2021 is scammers posing as major investment firms and major entities,” she said. “Copying their prospectus (and) just changing the contact details.
“We’ve seen them pose as [international investment firm] Vanguard, we’ve seen them pose as Credit Suisse and a number of other organisations.”
Google told the ABC it was “working hard” to stop dodgy operators from advertising on the search engine through what it described as a range of measures.
The final twist
More than two months on from being scammed, Mr Papagiannopoulos had been told there was little hope any more of his money would be recovered.
But then came a surprise.
After speaking to the ABC and lodging his case with the Australian Financial Complaints Authority (AFCA), Westpac got in touch with Mr Papagiannopoulos at the beginning of June.
Westpac told him it had recovered another $84,000 on May 27.
It means $198,000 was returned to Mr Papagiannopoulos and the scammers only made $2,000 from their elaborate scheme.
Westpac said it could not disclose how it managed to retrieve the rest of the money, but that its scam and fraud department had worked “very hard” to get the payments.
Citibank said although it was able to recover nearly 100 per cent of the fraudulent funds, consumers were advised to remain vigilant.
It said in February it alerted customers via email that scammers were posing as financial institutions offering investment products.
Jill’s $75,000 is still missing, but Mr Papagiannopoulos’s news has given her some hope she and her husband might also get some of their money back.
Mr Papagiannopoulos said he was still recovering from the experience.
After initially feeling shame and embarrassment, he said he’d learned to stop blaming himself.
He hopes speaking out might force regulators to ensure banks are making sure an account holder is actually who they say they are.
He also has more questions for the banks involved, including how they were able to retrieve the money so long after the scam.
“I have a feeling there’s a lot of other people out there [who’ve been scammed],” he said.
“I want to ask the question [to the banks] about how and why?”
He said he feels no ill will towards those running the elaborate scheme and instead wants the banks to stop allowing criminals to set up fraudulent accounts to run the scams.
“They didn’t have all the tools by themselves to get to me – somebody else has helped them,” he said.
“These are the tools that we need to fix so they can’t do that work anymore.”
